05000529/LER-2005-003
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. None 05000 | |
| Event date: | 06-23-2005 |
|---|---|
| Report date: | 08-13-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
| Initial Reporting | |
| 5292005003R00 - NRC Website | |
1. REPORTING REQUIREMENT(S):
This LER (50-529/2005-003-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(vii), to report an event where a single condition caused two independent trains to become inoperable in a single system designed to remove residual heat and mitigate the consequences of an accident. Specifically, on June 23, 2005 a watertight fire door (EIIS: NM, DR) functioning as the train separation barrier between Auxiliary Feedwater (AFW) (EIIS: BA) pump rooms "A" and "B" was left open and unattended for 43 minutes.
As a result, AFW trains "A" and "B" where rendered inoperable.
This event was initially reported to the Headquarters Operation Center as ENS 41789.
The event was reported as an unanalyzed condition that significantly degrades plant safety [10 CFR 50.72(b)(3)(ii)(B)]. Subsequent review concluded that the event was not reportable under that criterion and the original ENS notification was not required.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The AFW system consists of one essential steam turbine driven pump (train "A") (EIIS:
BA, P, TRB), one essential motor driven AFW pump (train "B") (EIIS: BA, P, MO), and one non-essential motor driven AFW pump (train "N") configured into three trains. The essential steam turbine-driven and motor-driven AFW pumps are located on the 80 ft level in the Main Steam Support Structure (EIIS: NM) in separate rooms designed to seismic category I requirements. Each essential pump provides 100 percent of AFW flow capacity to the steam generators (EIIS: AB, SG) as assumed in the accident analysis. The AFW system mitigates the consequences of any event with a loss of normal feedwater (EIIS: SJ). The design basis of the essential AFW trains is to supply water to the steam generator to remove decay heat and other residual heat, by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to 1270 psia at the entrance to the steam generators. A watertight fire door (C-A06) functions as the train separation barrier between AFW train "A" and "B" pump rooms.
3. INITIAL PLANT CONDITIONS:
On June 23, 2005 at approximately 0823 MST Palo Verde Unit 2 was in Mode 1 (power operations), operating at approximately 100 percent power. There were no major structures, systems, or components inoperable at the start of the event that contributed to the event.
4.� EVENT DESCRIPTION:
June 23, 2005 at approximately 0823 Mountain Standard Time (MST) Unit 2 was operating at 100 percent power, mode 1, when control room personnel were notified that door C-A06 had been found open by maintenance personnel with no compensatory measures established. Door C-A06 is a watertight fire door that functions as the train separation barrier between AFW pump room "A" and "B." When door C-A06 is open with the unit operating in mode 1, compensatory action must be taken in order to maintain both AFW trains "A" and "B" operable. At 0823 MST, when the control room was notified of the condition, actions had been taken by maintenance personnel at door C-A06 to compensate for the door being open. The shift manager requested that security personnel obtain a copy and review the security computer transaction log for door C-A01 to determine who had previously entered and exited AFW pump room "A.
(At the time of the event, the only access to AFW pump room "B" was through door C- A06 via AFW pump room "A" and door C-A01.) Based on a review of the security computer transaction log for docr C-A01, control room personnel determined that door C-A06 was opened with no compensatory actions taken between approximately 0712 and 0755 (43 minutes). As such, AFW trains "A" and "B" were considered inoperable between 0712 and 0755.
Based on the security transaction log review and interviews with security, maintenance, and work control personnel, at 0710 MST on June 23, a security officer (utility, non licerised) entered AFW pump room "A" to perform testing on door C-A01. During the performance of the test, the security officer experienced radio communication problems and was unable to hear the radio transmissions being made by the Secondary Alarm Station. The security officer remembered from previous experience that radio transmissions could be heard in the AFW pump room "B." The security officer opened door C-A06, entered AFW pump room "B," and after hearing the expected repeated radio transmission, returned to door C-A01 to continue testing. The security officer did not close or take compensatory actions for door C-A06 after leaving AFW pump room "B." At 0712 MST, the security officer completed testing on door C-A01 and exited the area leaving door C-A06 open with no compensatory measures established. At 0755 MST (43 minutes later) maintenance personnel entered AFW pump room "A" to perform a pre-job walk down and noticed that door C-A06 was open. The maintenance crew provided compensatory measures for door C-A06 while they were in the area. When preparing to leave, one of the maintenance crew workers called the work control desk and asked if door C-A06 should be left in the open or closed position. At approximately 0823 MST, work control advised the maintenance crew that door C-A06 should be closed and notified the control room of the event. At approximately 0823 MST maintenance personnel closed door C-A06 and exited the area at 0832 MST.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
On June 23, 2005, from 0712 to 0755 MST the two essential trains of AFW ("A" and "B") were considered inoperable due to an opened, uncompensated watertight fire door— the non-essential train of AFW ("N") remained operable. The AFW system is designed to mitigate the consequences of any event with a loss of normal feedwater. Because no actual loss of normal feedwater occurred on June 23, 2005 there were no actual safety consequences associated with the two essential trains of AFW being rendered inoperable for 43 minutes.
Technical Specification Limiting Condition for Operation (LCO) 3.7.5 condition "C" provides required actions for two AFW trains inoperable in modes 1, 2, or 3. The required action is to be in mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The LCO was restored in approximately 43 minutes — less than the Completion Time required by Technical Specifications. The Technical Specification Bases state that the LCO 3.7.5(c) allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
The risk associated with 43 minutes of exposure to flooding, fire or a seismic event was reviewed by the Probabilistic Risk Assessment personnel. A core damage frequency of 1E-7 delta CDF was considered the threshold for having very low safety significance.
Operation with the watertight fire door open for 152 hours0.00176 days <br />0.0422 hours <br />2.513228e-4 weeks <br />5.7836e-5 months <br /> would be required to reach the 1E-7 delta CDF threshold due to a flooding event. Similarly, operation with the watertight fire door open for 14,624 hours0.00722 days <br />0.173 hours <br />0.00103 weeks <br />2.37432e-4 months <br /> would be required to reach the 1E-7 delta CDF threshold due to a fire event. There is no change to seismic risk, since the barrier provides no protection against an earthquake. The risk impact of having C-A06 opened and uncompensated for 43 minutes was minimal - below the threshold for having very low safety significance.
The condition would not have prevented the fulfillment of any safety function and did not result in a safety system functional failure as defined by 10 CFR 50.73(a)(2)(v).
6. CAUSE OF THE EVENT:
A security officer (utility, non-licensed) failing to close door C-A06 after exiting AFW pump room "B" caused the event. The incident investigation determined the failure was an isolated human performance error in that the security officer did not apply a sufficient degree of attention while exiting door C-A06. No procedural or training weaknesses associated with the proper operation of door C-A06 were found to have been contributing factors in the event.
7. CORRECTIVE ACTIONS:
The security officer responsible for the event was coached on securing watertight fire doors. Additionally, a security briefing was issued to inform security personnel of the event.
8. PREVIOUS SIMILAR EVENTS:
In the past three years, no previous similar events were reported.